JP2016051250A - Function control system, method, setting information management apparatus, user terminal, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technology of flexibly controlling operation of an application in a user terminal.SOLUTION: A function control system includes a setting information management apparatus 120, and a user terminal. The setting information management apparatus 120 includes: a user management section 121 which manages user information on each of users; an encryption condition specifying section 124 which sets encryption conditions corresponding to the users; an authority setting section 122 which issues setting information of functions of applications; and an encryption execution section 123 which encrypts authentication information. The user terminal includes: a setting information storing section which stores the encrypted setting information; a decryption information collection section which collects information required for decrypting the encrypted setting information; a decryption execution section which decrypts the encrypted setting information by use of the collected information; and a function execution section which controls whether to execute a function of an application on the basis of the decrypted setting information, or branching the execution.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control technology for a terminal device, and relates to a technology for remotely controlling a terminal device by a control device.

  Currently, various devices, applications, and contents are installed in mobile PC terminals and smartphone terminals, and various services using them can be provided. In addition to this, the mobile PC terminal device, the smart phone terminal device, and the like have mobility and constant availability so that the user can enjoy these services in various usage environments.

  On the other hand, since services and usage environments are diverse, there may be a problem when an appropriate service corresponding to the usage environment is not provided. For example, when a mobile PC terminal with applications and contents that should be used within the company is taken out of the company and used, or conversely, devices that should not be used within the company (camera devices, etc.) This is the case when a smartphone terminal device equipped with is brought into a company and used. In addition, the business mode of using smartphones owned by company employees called BYOD (Bring Your Own Device) within the company complicates the division between business use and private use.

  As a solution to such a problem, there is an MDM (Mobile Device Management) service that prevents a business terminal device from being used in advance other than devices and applications used in business (for example, Non-Patent Document 1, 2). However, in the methods of Non-Patent Documents 1 and 2, devices and applications that can be used there are fixedly restricted regardless of the usage environment of the terminal device, so the terminal device can be flexibly controlled according to an arbitrary usage environment. Can not do it. For this reason, only business applications can be executed in corporate offices, while business applications cannot be executed at home, and private applications can be executed at home. There are cases where it cannot be controlled flexibly. For this reason, Non-Patent Document 1 proposes a control method based on control information indicating whether or not to permit execution of a specific service to an arbitrary terminal device as a technique capable of flexibly controlling the terminal device. doing. In this method, control information is encrypted with information that can be collected by an arbitrary terminal device, and the control information is decrypted only when the usage environment of the terminal satisfies the encrypted condition. The function of the terminal is controlled by starting or stopping the specified service.

  In general, the encryption algorithm used for encryption is a common key encryption method that uses the same key for encryption and decryption using a hash function that performs one-way conversion that cannot restore the original data, and is used for encryption and decryption. There are public key cryptosystems with different keys (public key and private key), and they are used and combined according to the purpose. In addition, as predicate encryption, which is an extension of public key cryptography, encryption / decryption conditions can be set to a single parameter or multiple parameters and their logical operations (logical sum (OR condition), logical product (AND condition)). An encryption method that can be given as a negative (NOT condition) and a combination thereof has also been proposed. The encryption method that encrypts / decrypts with a single parameter is called ID-based encryption, and the method that encrypts / decrypts with multiple parameters and their logical expressions is called functional encryption. For both ID-based encryption and functional encryption, a set of master public key and master secret key paired in advance is generated, and different public and private keys are generated for each parameter by calculating the master public key and master secret key and parameters. (For example, refer to Non-Patent Document 3, Patent Document 2, and Patent Document 3.)

  Patent Document 1 uses predicate encryption for encryption and performs encryption / decryption using the usage environment of the user terminal as a parameter.

“Smartphone remote control service”, [online], NTT DoCoMo, Inc., [searched on August 22, 2014], Internet <URL: http://www.docomo.biz/html/service/ remotecontrol / ＞ “Smartphone Remote Control Service Service Guidelines”, [online], July 15, 2011, NTT DoCoMo, Inc., [Search August 22, 2014], Internet <URL: http: // www.docomo.biz/pdf/html/service/remotecontrol/pdf_02.pdf> Tetaro Kobayashi, Go Yamamoto, Kotaro Suzuki, Shinichi Hirata, “Application of ID-based cryptography and keyword search cryptography”, NTT Technical Journal, 2010, p.17-20

JP2013-74302A JP 2011-4366 A Japanese Patent No. 5253567

  However, the method of Patent Document 1 has a problem that the unit to be controlled is an application unit, and more precise control such as changing an internal function that can be used in the application cannot be performed depending on the usage environment.

  The present invention has been made in view of these points, and provides a function control system, method, setting information management apparatus, user terminal, and program capable of flexibly controlling the operation of an application in a terminal apparatus. The purpose is to do.

  In order to solve the above-described problem, a function control system according to an aspect of the present invention includes a user management unit that manages user information of each user and an encryption condition setting that corresponds to each user. A setting information management device having an encryption condition specifying unit to perform, an authority setting unit for issuing setting information of each function of each application, and an encryption execution unit for encrypting the authentication information, and the encrypted A setting information storage unit for storing setting information, a decryption information collection unit for collecting information necessary for decrypting the encrypted setting information, and decrypting the encrypted setting information using the collected information And a user terminal having a function execution unit that branches whether or not to execute the function of the application based on the decoded setting information.

  ADVANTAGE OF THE INVENTION According to this invention, operation | movement of the application in a terminal device can be controlled flexibly.

The functional block diagram of the example of the function control system (prior distribution type) of 1st embodiment. The image figure of the example of a structure of setting information. The figure which shows the processing flow of the example of the function control system of 1st embodiment. The functional block diagram of the example of the function control system (as needed distribution type) of 2nd embodiment. The figure which shows the processing flow of the example of the function control system of 2nd embodiment.

Hereinafter, embodiments of the present invention will be described.
<First embodiment: Advance distribution type>
In the present embodiment, an embodiment in which application setting information is arranged on a terminal in advance will be described.

  FIG. 1 is a block diagram of an example of a function control system according to the first embodiment. The function control system of the first embodiment includes a user terminal 110 and a setting information management device 120. The user terminal 110 includes a setting information storage unit 111, a function execution unit 112, a decryption execution unit 113, and a decryption information collection unit 114. The setting information management apparatus 120 includes a user management unit 121, an authority setting unit 122, an encryption execution unit 123, and an encryption condition designation unit 124. FIG. 3 is an example of a processing flow of the function control system of the first embodiment.

  In the setting information management apparatus 120, a user management unit 121 manages user information of each user.

  The encryption condition designation unit 124 designates an encryption method for encrypting the setting information and encryption / decryption conditions for each user (step S101). The encryption / decryption conditions may be individual for each user, common to a plurality of users, or common to all users. These designated encryption methods and conditions are managed by the user management unit 121 as user information.

  The authority setting unit 122 generates setting information for each application to be controlled (step S102). In other words, the authority setting unit 122 issues setting information for each function of each application. The setting information is not a portion that indicates whether or not each application can be used, but a portion in which whether or not each function in each application is used is set.

  FIG. 2 shows a configuration example of the setting information. In the basic setting information, information such as individual functions to be controlled and connection destinations are described. For individual functions to be controlled, function ON / OFF or connection destination information is described for each control pattern, and usage conditions are set for each pattern. One or more usage conditions can be specified. In this example, the setting information is hierarchically configured from two pieces of information, basic setting information and control target setting information.

  Referring to FIG. 2 as an example, if the user's terminal is outside the company, only saving is possible, and if the user's terminal is inside the company, saving and file name change are operable. In addition, data can be copied and pasted only within the company and during working hours. An operation can be canceled or re-executed under any conditions. As connection destination information, in the case of an employee, a control method for changing a server that can be connected inside or outside the company is specified. In the case of a contractor, only uploading to a server is permitted, and downloading is prohibited. Note that the application setting information of the present invention is not limited to the format described in FIG.

  The authority setting unit 122 refers to the usage condition for each of the user to be controlled from the user management unit 121 (step S103).

  If encryption is specified in the usage conditions, the authority setting unit 122 transmits the specified encryption conditions and corresponding setting information to the encryption execution unit 123 (step S104).

  The encryption execution unit 123 returns the encrypted setting information to the authority setting unit 122 (step S105).

  The authority setting unit 122 distributes the encrypted setting information to the user terminal 110 (step S106). If the setting information is not encrypted, the unencrypted setting information is distributed to the user terminal 110.

  Distribution to the user terminal 110 can be performed online or offline. The setting information can be distributed simultaneously with the application to be controlled, or can be distributed at another time.

  In the user terminal 110, the setting information distributed from the setting information management device 120 is stored in the setting information storage unit 111.

  In the user terminal 110, when the control target application is activated or executes a certain function, the setting target file stored in the setting information storage unit 111 is referred to (step S111).

  If the acquired setting information is encrypted, the function execution unit 112 requests the decryption execution unit 113 to decrypt the setting information (step S112).

  The decryption execution unit 113 requests the decryption information collection unit 114 to collect decryption information necessary for decrypting the encrypted setting information (step S113).

  The decryption information collected by the decryption information collection unit 114 is transmitted to the decryption execution unit 113 (step S114), the decryption process is performed by the decryption execution unit 113, and the decrypted setting information is transmitted to the function execution unit 112 (step S114). S115).

  The function execution unit 112 refers to the unencrypted setting information acquired from the setting information storage unit 111 or the setting information decrypted by the flow from step S112 to step S114, and determines whether the function can be executed or the function is branched. Control. The encryption / decryption used in the flow from step S101 to step S103 and from step S112 to step S115 can use any method including a common key encryption method, a public key encryption method, an ID-based encryption method, and a functional encryption method. is there.

  Hereinafter, examples of encryption conditions and decryption information when each encryption method is used will be described.

  In the case of the common key cryptosystem, the encryption conditions and the decryption information are common keys for encryption / decryption. The common key generated in the encryption condition specification unit 124 of the setting information management device 120 is stored in an arbitrary location accessible by the decryption information collection unit 114 of the user terminal 110.

  In the case of the public key scheme method, a public key and a secret key are generated in pairs. A public key is used for encryption conditions and a secret key is used for decryption information. The encryption condition designating unit 124 designates a public key to be used for each user, and transmits the paired secret key to the user terminal 110. The secret key is stored in an arbitrary location accessible by the decryption information collection unit 114 of the user terminal 110. An electronic certificate can also be used as a format for generating and storing a public key / private key pair.

  In the case of the ID-based encryption method, the master public key and the master secret key are stored in the encryption execution unit 123 of the setting information management apparatus 120 and the decryption execution unit 113 of the user terminal 110, respectively. The encryption condition designation unit 124 designates a parameter type and a parameter value to be calculated with the master public key and the master secret key. Arbitrary information such as user ID, terminal unique ID, date, time, and IP address can be specified as parameters. The designated parameter type is stored in the setting information storage unit 111 of the user terminal 110 together with the encrypted file. In steps S <b> 113 to S <b> 115, the decryption information collection unit 114 of the user terminal 110 acquires information specified by the parameter type and transmits it to the decryption execution unit 113.

In the case of the functional encryption method, the implementation is the same as the ID-based encryption method. The difference from the ID-based encryption method is that, in specifying the encryption conditions, it is possible to specify a set of parameter types and parameter values and their logical operation expressions, and the decryption information collection unit 114 specifies a plurality of specified values. It is to collect information.
<Second embodiment: Anytime distribution type>
In the present embodiment, an implementation using a method of distributing setting information as needed will be described.

  Below, it demonstrates centering on difference with 1st embodiment, and abbreviate | omits description about the common point with 1st embodiment using the same reference number.

  FIG. 4 is a block diagram of an example of a function control system according to the second embodiment. Compared with FIG. 2, a user information storage unit 115 and a setting information acquisition unit 116 that store user information are added to the user terminal 110, and a setting information distribution unit 125 that distributes setting information is added to the setting information management device 120. Has been. FIG. 5 is an example of a processing flow of the function control system of the second embodiment.

  The flow from the setting of the user condition to the encryption of the setting information is the same as that from step S101 to step S104 in the first embodiment. Through a series of flows, unencrypted setting information or encrypted setting information is stored in the user information storage unit 115 (steps S205 and S206).

  In the user terminal, the setting information acquisition unit 116 transmits the user ID, terminal ID, user attribute information, and the like acquired from the user information storage unit 115 to the setting information management device 120 (steps S211 and S212).

  The setting information distribution unit 125 in the setting information management apparatus 120 transmits the transmitted information to the user management unit 121, and acquires setting information that matches the conditions (step S213).

  The acquired setting information is transmitted to the user terminal 110 and stored in the setting information storage unit 111 of the user terminal 110 (steps S214 and S215).

  In the user terminal 110, when an application to be controlled is activated or executes a certain function, control of the application is executed by the same flow and processing as in steps S111 to S115 in the first embodiment.

Thus, the setting information control information may be distributed at any time. The acquisition of the setting information in the user terminal 110 may be triggered by the activation of the application or execution of the function, an independent trigger, or both.
<Modifications>
The processes described in the above apparatus and method are not only executed in time series according to the description order, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the process.

  In addition, various processing functions in each device described in the above embodiments and modifications may be realized by a computer. In that case, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Further, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its storage unit. When executing the process, this computer reads the program stored in its own storage unit and executes the process according to the read program. As another embodiment of this program, a computer may read a program directly from a portable recording medium and execute processing according to the program. Further, each time a program is transferred from the server computer to the computer, processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program includes information provided for processing by the electronic computer and equivalent to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In addition, although each device is configured by executing a predetermined program on a computer, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 110 User terminal 111 Setting information storage part 112 Function execution part 113 Decryption execution part 114 Decryption information collection part 115 User information storage part 116 Setting information acquisition part 120 Setting information management apparatus 121 User management part 122 Authority setting part 123 Encryption Execution unit 124 Encryption condition designation unit 125 Setting information distribution unit

Claims (12)

A user management unit for managing user information of each user, an encryption condition specifying unit for setting encryption conditions corresponding to each user, and issuing setting information for each function of each application A setting information management device having an authority setting unit and an encryption execution unit that encrypts the authentication information;
A setting information storage unit for storing the encrypted setting information, a decryption information collection unit for collecting information necessary for decrypting the encrypted setting information, and the encrypted information using the collected information. A user terminal having a decoding execution unit for decoding the set information, and a function execution unit for branching execution or non-execution of the function of the application based on the decoded setting information,
Including function control system. The control system according to claim 1,
The setting information management device further includes a setting information distribution unit that distributes the encrypted setting information to the user terminal,
The user terminal further includes a setting information acquisition unit that acquires the encrypted setting information from the setting information management device.
Function control system. The user authentication system according to claim 1 or 2,
Whether the function can be executed by changing the setting information or has a function to branch the function.
Function control system. A function control system according to any one of claims 1 to 3,
Use a common encryption method for encryption / decryption of the setting information.
Function control system. A function control system according to any one of claims 1 to 3,
Use public key cryptography for encryption / decryption of the setting information,
Function control system. The user authentication system according to claim 5,
A public key / private key acquired from an electronic certificate is used for encryption / decryption of setting information, and a public key authentication infrastructure (PKI) is used for authentication of the electronic certificate.
Function control system. A function control system according to any one of claims 1 to 3,
Use ID-based encryption method for encryption / decryption of the setting information,
Function control system. A function control system according to any one of claims 1 to 3,
Use functional encryption for encryption / decryption of the setting information
Function control system. A user management step in which a user management unit manages user information of each user;
An encryption condition specifying step for setting an encryption condition corresponding to each of the above users, and an encryption condition specifying step;
A setting information management step in which the authority setting unit issues setting information of each function of each application;
An encryption execution unit that encrypts the authentication information; and
A setting information storage step in which the setting information storage unit stores the encrypted setting information;
A decryption information collection unit for collecting information necessary for decrypting the encrypted setting information;
A decryption execution unit for decrypting the encrypted setting information using the collected information; and
A function execution step in which the function execution unit determines whether or not to execute the function of the application based on the decoded setting information or branches the execution;
A function control method including: A user management unit that manages user information of each user;
An encryption condition specifying unit for setting an encryption condition corresponding to each of the above users,
An authority setting unit that issues setting information for each function of each application;
An encryption execution unit for encrypting the authentication information;
A setting information management device. A setting information storage unit for storing setting information of each function of each application encrypted by the setting information management device;
A decryption information collection unit for collecting information necessary for decrypting the encrypted setting information;
A decryption execution unit for decrypting the encrypted setting information using the collected information;
A function execution unit for performing the execution of the function of the application based on the decrypted setting information or branching the execution;
User terminal including   The program for functioning a computer as each part of the setting information management apparatus of Claim 10, or the user terminal of Claim 11.

Images